argocd oidc

mv example-f75ef679f225.json dex-google-groups-sa.json

{
  "type": "service_account",
  "project_id": "<PROJECT_NAME>",
  "private_key_id": "XXXX",
  "private_key": "-----BEGIN PRIVATE KEY-----\nXXXX\n-----END PRIVATE KEY-----\n",
  "client_email": "XXXX@<PROJECT_NAME>.iam.gserviceaccount.com",
  "client_id": "XXXX",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metabeta/x509/XXXX%40<PROJECT_NAME>.iam.gserviceaccount.com",
  "universe_domain": "googleapis.com"
}

kubectl create secret generic argocd-google-groups-json \
  -n argocd \
  --from-file googleAuth.json=dex-google-groups-sa.json

secret/argocd-google-groups-json created

apiVersion: v1
kind: Secret
metadata:
  name: argocd-google-groups-json
  namespace: argocd
data:
  googleAuth.json: <JSON_FILE_BASE64_ENCODED>

kubectl get secret -n argocd argocd-google-groups-json

NAME                        TYPE     beta   AGE
argocd-google-groups-json   Opaque   1      28s

# charts/argocd/values.yaml
dex:
  # -- Additional volumeMounts to the dex main container
  volumeMounts:
    - name: google-json
      mountPath: /tmp/oidc
      readOnly: true

  # -- Additional volumes to the dex pod
  volumes:
    - name: google-json
      secret:
        defaultMode: 420
        secretName: argocd-google-groups-json

# charts/argocd/values.yaml
configs:
  cm:
    dex.config: |
      connectors:
      - config:
          redirectURI: https://argocd.example.com/api/dex/callback
          clientID: XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com
          clientSecret: XXXXXX-XXX-X-XXXXXXXXXXXXXXXXXXXXXX
          serviceAccountFilePath: /tmp/oidc/googleAuth.json
          adminEmail: workspace-admin@example.com
          fetchTransitiveGroupMembership: True
        type: google
        id: google
        name: Google      
  rbac:
    scopes: ['groups']

# charts/argocd/values.yaml
configs:
  cm:
    dex.config: |
      connectors:
      - config:
          redirectURI: https://argocd.example.com/api/dex/callback
          clientID: XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com
          clientSecret: XXXXXX-XXX-X-XXXXXXXXXXXXXXXXXXXXXX
          serviceAccountFilePath: /tmp/oidc/googleAuth.json
          adminEmail: workspace-admin@example.com
          fetchTransitiveGroupMembership: True
        type: google
        id: google
        name: Google      
  
  rbac:
    # -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions.
    # If false, it is expected the configmap will be created by something else.
    # Argo CD will not work if there is no configmap created with the name above.
    create: true

    # -- Annotations to be added to argocd-rbac-cm configmap
    annotations: {}

    # -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).
    # If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...
    policy.default: role:readonly

    # -- File containing user-defined policies and role definitions.
    # @default -- `''` (See [values.yaml])
    policy.csv: |
      ## `role:admin` and `role:readonly` are predefined roles in argocd
      p, role:image-updater, applications, get, */*, allow
      p, role:image-updater, applications, update, */*, allow
      g, image-updater, role:image-updater

      p, role:team_beta, applications, get, beta/*, allow
      p, role:team_beta, applications, get, ingress/beta-internal-ingress, allow
      p, role:team_beta, certificates, get, *, allow
      p, role:team_beta, clusters, get, *, allow
      p, role:team_beta, repositories, get, *, allow
      p, role:team_beta, projects, get, beta, allow
      p, role:team_beta, projects, get, ingress, allow
      p, role:team_beta, accounts, get, *, allow
      p, role:team_beta, gpgkeys, get, *, allow
      p, role:team_beta, logs, get, beta/*, allow
      p, role:team_beta, exec, create, beta/*, allow

      p, role:team_gamma, applications, get, gamma/*, allow
      p, role:team_gamma, applications, get, ingress/beta-internal-ingress, allow
      p, role:team_gamma, applications, sync, gamma/*, allow
      p, role:team_gamma, certificates, get, *, allow
      p, role:team_gamma, clusters, get, *, allow
      p, role:team_gamma, repositories, get, *, allow
      p, role:team_gamma, projects, get, gamma, allow
      p, role:team_gamma, projects, get, ingress, allow
      p, role:team_gamma, accounts, get, *, allow
      p, role:team_gamma, gpgkeys, get, *, allow
      p, role:team_gamma, logs, get, gamma/*, allow
      p, role:team_gamma, exec, create, gamma/*, allow

      # [group-mail] admin
      g, team_admin@example.com, role:admin

      # [group-mail] beta team
      g, team_beta@example.com, role:team_beta

      # [group-mail] gamma team
      g, team_gamma@example.com, role:team_gamma      

    # -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).
    # The scope value can be a string, or a list of strings.
    scopes: "[groups]"

    # -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher.
    policy.matchMode: "glob"

# charts/argocd/values.yaml
configs:
  rbac:
    policy.default: role:readonly

# charts/argocd/values.yaml
configs:
  cm:
    # -- Enable exec feature in Argo UI
    ## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource
    exec.enabled: true

p, <role/user/group>, <resource>, <action>, <appproject>/<object>, allow

# charts/argocd/values.yaml
configs:
  rbac:
    policy.csv: |
      # StatefulSet 리소스 재시작 권한을 부여하는 예제입니다.
      p, role:team_beta, applications, action/app/StatefulSet/restart, beta/app-backend, allow
      p, role:team_beta, applications, action/app/StatefulSet/restart, beta/app-frontend, allow

      # Rollout 리소스 재시작 권한을 부여하는 예제입니다.
      p, role:team_beta, applications, action/argoproj.io/Rollout/restart, beta/app-backend, allow
      p, role:team_beta, applications, action/argoproj.io/Rollout/restart, beta/app-frontend, allow

      # Deployment 리소스 재시작 권한을 부여하는 예제입니다.
      p, role:team_beta, applications, action/app/Deployment/restart, beta/app-backend, allow
      p, role:team_beta, applications, action/app/Deployment/restart, beta/app-frontend, allow

      g, team_beta@example.com, role:team_beta      

# charts/argocd/values.yaml
configs:
  cm:
    policy.default: role:readonly
    policy.csv: |
      p, role:team_beta, exec, create, beta/*, allow
      g, team_beta@example.com, role:team_beta      

# charts/argocd/values.yaml
# argocd v2.9
configs:
  cm:
    policy.csv: |
      p, role:team_beta, applications, delete, beta/important-backend-api, allow
      g, team_beta@example.com, role:team_beta      

kubectl rollout restart deployment -n argocd dex-server

dex-server time="2024-11-25T05:28:20Z" level=error msg="Failed to authenticate: google: could not retrieve groups: could not list groups: Get \"https://admin.googleapis.com/admin/directory/v1/groups?alt=json&pageToken=&prettyPrint=false&userKey=alice%40example.com\": oauth2: cannot fetch token: 401 Unauthorized\nResponse: {\n  \"error\": \"unauthorized_client\",\n  \"error_description\": \"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.\"\n}"
dex-server time="2024-11-25T05:28:22Z" level=error msg="Failed to authenticate: google: could not retrieve groups: could not list groups: Get \"https://admin.googleapis.com/admin/directory/v1/groups?alt=json&pageToken=&prettyPrint=false&userKey=bob%40example.com\": oauth2: cannot fetch token: 401 Unauthorized\nResponse: {\n  \"error\": \"unauthorized_client\",\n  \"error_description\": \"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.\"\n}"

# charts/argocd/values.yaml
configs:
  dex.config: |
    connectors:
    - config:
        adminEmail: team_admin@example.com    

# charts/argocd/values.yaml
configs:
  dex.config: |
    connectors:
    - config:
        adminEmail: workspace-admin@example.com    

kubectl rollout restart deployment -n argocd dex-server